Scores of customers of Michaels craft stores in the Chicago area have reported having money swiped from their bank accounts in what appears to be widespread thefts involving purloined debit card information.
The thieves most likely pulled off the scam by tampering with the PIN pads at store checkout counters where customers swipe their cards and punch in their secret codes. Anyone who gets that information could, at an ATM, withdraw money from the debit card’s bank account.
Authorities throughout the region confirmed that thieves stole money from many bank accounts via out-of-state ATMs. The victims all shopped at a Michaels here, and most reported having exactly $503 stolen — a $500 withdrawal, in addition to a $3 cash machine fee.
Victims reported problems after making purchases at Michaels, including stores in Chicago, Bloomingdale, Vernon Hills, Mount Prospect, Niles, Burbank, Naperville, Glenview and Hoffman Estates. Michaels has 35 stores in and around Chicago.
The episodes are the latest in a spate of security breaches that have compromised consumers’ personal information, highlighting a race between security experts and thieves with high-tech skills.
“This isn’t anything new, but the attackers appear to be much more organized,” said Colin Sheppard, a data security expert at Trustwave of Chicago.
Michaels Stores Inc. said it is working with authorities to assess the scope of the fraud.
“Most of the banks we have talked with believe that any fraudulent activity originated in our Chicago stores,” said Doug Marker, the company’s vice president of loss prevention and safety. “We do not know how widespread the issue is.”
Michaels was first contacted about the breaches late Monday, he said, but the company could not provide a dollar amount that has been stolen.
The breaches appear to have originated at checkout line swipe pads.
“We are not excluding any possibilities from our investigation, but at this point we believe PIN pad tampering may have occurred,” Marker said.
Customers who purchased items from a Michaels with a debit or credit card should monitor their statements, report suspicious account activity and change debit card PINs and other account security settings.
There are a number of ways thieves steal information from a PINpad, including placing on the machine an electronic “skimming” device or bug that captures or intercepts card information and personal identification numbers. In other cases, thieves or accomplice employees swap out the swipe pad with one that captures data, security experts said.
“Physical attacks, such as skimming, are now one of the most common ways criminals are stealing data,” said Bob Russo, general manager of the PCI Security Standards Council.
Discount grocer Aldi, based in Batavia, said it experienced an episode last year in which thieves placed their own payment card terminals in some stores, including in the Chicago area.
Experts advise consumers to inspect PIN pads, especially at remote locations such as ATMs and gas stations, because machines that have been tampered with sometimes are readily identifiable.
Thieves also can hack into computer systems to steal information, Sheppard said, but because PIN codes are encrypted during transmission, the easiest way to steal account information from the magnetic stripe and PIN code is at the keypad.
“This is most likely hardware tampering,” he said.
Skimming devices can easily be purchased online. The information can be automatically retrieved via cellular networks.
More Top Picks Tv Stands
The Bloomingdale Police Department is investigating at least 16 reports of fraud involving Michaels customers. All victims used debit cards at a Michaels, Bloomingdale Police Chief Frank Giammarese said.
Vernon Hills and Naperville police, among others, have reports of about a dozen cases each.
ATM cash withdrawals have been occurring only in recent days. But the time frame for making purchases at Michaels stretches back months, perhaps as early as December, Giammarese said. Withdrawals are being made out of state, including in California and possibly Nevada.
The U.S. Secret Service began an investigation Wednesday but said it was too early to give an update on its progress.
Among the victims was Mary Allen, 49, of Libertyville. She shopped at the Michaels in Vernon Hills about a month ago to buy a craft kit for her son’s school project. She didn’t find out until Wednesday about two fraudulent withdrawals of $503 each from her account — when she tried to withdraw cash at an ATM and her debit card was declined.
“Your heart stops the minute your card is declined at the ATM machine,” Allen said. “You think someone has stolen your ID, and that’s your worst nightmare.”
She said her bank, Harris Bank, told her she would be reimbursed the $1,006 within five business days.
Banks protect customers from credit card fraud, but debit card crime is typically a greater hassle for consumers because money is withdrawn from a victim’s bank account and they must fight to get it back.
It can take several days to weeks to get the money replaced after reporting the theft, said Jay Foley, executive director of the Identity Theft Resource Center. Many debit card issuers promise customers they will be liable for, at most, $50 in a fraud case, but there’s no federal protection dictating that, like there is with credit cards, he said.
Harris Bank said it is bending rules for this case.
“In this particular situation, Harris has decided that it will reimburse customers up to the amount of the fraudulent ATM withdrawal that is a result of this data breach,” a spokeswoman said.
Allana Amiran, 29, and her mother, Diane Robertson, both of Mount Prospect, shopped together at a Michaels in Mount Prospect in February to buy scrapbook supplies as a gift for a friend’s birthday. They both used the PIN pad to make purchases with their debit cards.
This week, both were victims of debit card fraud. Amiran’s account was debited $503 for a cash withdrawal in San Bernardino, Calif. She has since been given a provisional credit of $453 by Harris Bank while it investigates, she said.
Her mother’s bank, Citibank, declined the thief’s ATM withdrawal, also for $503. She was notified Wednesday night by Citibank that her ATM card and PIN had been compromised. It canceled her card and issued a new one, Amiran said.
“It’s terrifying to know that it’s not even safe to use your card anymore at your local merchant,” Amiran said.
Tribune reporters Jeff Danna, Mick Swasko, Kate Thayer and Mary Owen contributed.